CVE-2026-82560: Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.
Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.
Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
podlators/Pod::Textto a version that resolves this vulnerability.Fixed in 6.1.1
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments using Pod::Text before version 6.1.1 are exposed when they format POD documents supplied by an attacker or another untrusted source.
What does an attacker need to trigger the issue?
The attacker needs to provide a POD document with sufficiently nested =over directives to drive the formatting margin to the output width. When that document is formatted, processing can fail to return and memory consumption can continue growing.
How can I determine whether an installation is affected?
Check the installed Pod::Text version. Versions earlier than 6.1.1 are affected.
What is the available remediation?
Upgrade Pod::Text to version 6.1.1 or later.